This document discusses cloud federation, which allows independent cloud providers to share resources and balance loads. There are four levels of federation: permissive (no verification), verified (identity verified via DNS), encrypted (TLS-encrypted connection with weak identity verification), and trusted (TLS-encrypted with strong authentication using trusted certificates). Cloud federation provides benefits like efficient resource use, load balancing, failure prevention, and avoiding vendor lock-in.

1. Cloud Federation

2. Why Cloud Federation?
• Capacity Management
• Load Balancing
• Efficient use of Surplus Resources
• Prevention from Power Outages & Failures
• Prevention from Vendor Lock-ins
• Scaling Data to Other CSPs(Cloud Service
Provider)

3. Why Cloud Federation?

4. Cloud Federation

5. Cloud federation
Cloud federation manages consistency and
access controls when two or more
independent geographically distinct Clouds
share either authentication, files, computing
resources, command and control or access to
storage resources.

6. Federated Cloud
• Federated cloud is also called as cloud Federation.
• Federation means the union of small parts that do
common work.
• It is the concept of brining different services offered by
various providers under a single platform.
• It is a multi-national cloud system that integrates
community , private , public clouds into scalable
computing platform.
• It is the deployment and management of multiple
external and internal cloud computing services to
match business needs.

7. Cloud federation
• It is the practice of interconnecting the cloud
computing environments of two or more service
providers for the purpose of load balancing traffic
and accommodating spikes in demand.
• It requires one provider to wholesale or rent
computing resources to another cloud provider.
• Those resources become a temporary or
permanent extension of the buyer’s cloud
computing environment, depending on the
specific federation agreement between providers.

8. Federation in the Cloud
• One challenge in creating and managing a
globally centralized cloud computing
environment is maintaining consistent
connectivity between untrusted components
while remaining fault-tolerant.
• A key opportunity for the emerging cloud
industry will be in defining a federated cloud
ecosystem by connecting multiple cloud
providers using a common standard

9. Federation in the Cloud
• A notable research project being conducted by
Microsoft, called the Geneva Framework, focuses
on issues involved in cloud federation.
• Many believe that those barriers can be
overcome by eXtensible Messaging and Presence
Protocol(XMPP), also called Jabber, as the
protocol that will fuel the Software – as – a –
Service(SaaS) models of tomorrow.
• Google, Apple, AOL,IBM,Livejournal, and Jive
have all incorporated this protocol into their
cloud-based solutions in the last few years.

10. • XMPP’s advantage:
– It is decentralized, meaning anyone may set up an
XMPP server.
– It is based on open standards
– It is mature – multiple implementations of client
and servers exist
– Robust security is supported via Simple
Authentication and Security Layer(SASL) and
Transport Layer Security(TLS)
– It is flexible and designed to be extended.

11. Federation in the Cloud
• XMPP is good fit for cloud computing because
– It allows for easy two way communication
– It eliminates the need for polling
– It has rich publish subscribe(pub-sub) functionality
built in
– It is XML-based and easily extensible, perfect for both
new IM features and custom cloud services.
– It is efficient and has been proven to scale to millions
of concurrent users on a single service(such as
Google’s Gtalk)
– It also has a built-in world wide federation model

12. Cloud Federation Stack

13. Four levels of Federation
• Permissive federation
• Verified federation
• Encrypted federation
• Trusted federation

14. Permissive federation
• Permissive federation occurs when server accepts a
connection from a peer network server without verifying its
identity using DNS lookups or certificate checking.
• The lack of verification or authentication may lead to
domain spoofing( the unauthorized use of a third-party
domain name in an email message in order to pretend to
be someone else), which opens the door to widespread
spam and other abuses.
• With the release of the open source jabbered 1.2 server in
October 2000, which included support for the Server
Dialback protocol( fully supported in Jabber XCP),
permissive federation met its demise on the XMPP
network.

15. Verified federation
• This type of federation occurs when a server accepts a
connection from a peer after the identity of the peer has
been verified.
• It uses information obtained via DNS and by means of
domain-specific keys exchanged beforehand
• The connection is not encrypted, and the use of identity
verification effectively prevents domain spoofing
• To make this work, federation requires proper DNS setup,
and that is still subject to DNS poisoning attacks
• Verified federation has been the default service policy on
the open XMPP since the release of the open-source
jabbered 1.2 server.

16. Encrypted Federation
• In this mode, a server accepts a connection from peer
if and only if the peer supports Transport Layer
Security(TLS) as defined for XMPP in Request for
Comments(RFC) 3920
• The peer must present a digital certificate
• The certificate may be self-signed , but this prevents
using mutual authentication
• If this is the case, both parties proceed to weakly verify
identity using Server Dialback
• XEP-0220 defines the Server Dialback protocol, which is
used between XMPP servers to provide identity
verfication.

17. Encrypted federation
• Server Dialback uses the DNS as the basis for verifying
identity; the basic approach is that when a receiving server
receives a server to server connection request from an
originating server, it does not accept the request until it has
verified a key with an authoritative server for the domain
asserted by the originating server.
• Although Server Dialback does not provide strong
authentication or trusted federation, and although it is
subject to DNS poisoning attacks, it has effectively
prevented most instances of address spoofing on the XMPP
network since its release in 2000
• This results in an encryp ted connection with weak identity
verification

18. Trusted federation
• Here, a server accepts a connection from peer only under the
stipulation that the peer supports TLS and the peer can present a
digital certificate issued by a root certification authority(CA) that is
trusted by the authenticating server.
• The list of trusted root CA s may be determined by one or more
factors, such as the operating system, XMPP server software, or
local service policy.
• In trusted federation, the use of digital certificates results not only
in a channel encryption but also in strong authentication
• The use of trusted domain certtificates effectively prevents DNS
poisoning attacks but makes federation more difficult, since such
certificates have traditionally not been easy to obtain.